Live › vulnerability › CVE-2019-11707
Go to dashboardMozilla Firefox and Thunderbird have a type confusion bug in the JavaScript Array.pop handling, reachable by manipulating JavaScript objects. An attacker who lures a user to a crafted page can cause a crash and, per the CISA listing, the flaw is known to be exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Mozilla Firefox and Thunderbird | vendor | – | – |
Check the installed Firefox or Thunderbird version under Help/About and compare it with the fixed release in the vendor advisory; the sources do not name the fixed version.
Update Firefox and Thunderbird to the latest release per vendor instructions, as CISA requires.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
This page as .md · .json · in your agent: get_signal("CVE-2019-11707")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.